@opengis/fastify-table 2.3.5 → 2.4.0

package/dist/server/routes/auth/controllers/jwt/token.js

@@ -1,6 +1,7 @@
 import pgClients from "../../../../plugins/pg/pgClients.js";
 import authorizeUser from "../../../../plugins/auth/funcs/authorizeUser.js";
 import checkJWT from "../../../../plugins/policy/funcs/checkJWT.js";
+import { BadRequestError, NotFoundError, UnauthorizedError, } from "../../../../../errors.js";
 const expireMsec = 1000 * 60 * 60;
 const getIp = (req) => (req.headers?.["x-real-ip"] ||
     req.headers?.["x-forwarded-for"] ||
@@ -15,24 +16,20 @@ export default async function oauthToken(req, reply) {
     const payload = req.method === "POST" ? body : query;
     const { grant_type, client_id, code, redirect_uri, code_verifier } = payload;
     if (grant_type !== "authorization_code") {
-        return reply.code(400).send({ error: "unsupported grant_type", code: 400 });
+        throw BadRequestError("unsupported grant_type");
     }
     if (!client_id) {
-        return reply
-            .code(400)
-            .send({ error: "not enough params: client_id", code: 400 });
+        throw BadRequestError("not enough params: client_id");
     }
     if (!code) {
-        return reply
-            .code(400)
-            .send({ error: "not enough params: code", code: 400 });
+        throw BadRequestError("not enough params: code");
     }
-    const { valid, payload: jwtPayload, redirectURIs, error, } = (await checkJWT(req)) || {};
+    const { valid, payload: jwtPayload, redirectURIs, } = (await checkJWT(req)) || {};
     if (!valid) {
-        return reply.code(401).send({ error, code: 401 });
+        throw UnauthorizedError("unauthorized");
     }
     if (redirect_uri && !(redirectURIs || []).includes(redirect_uri)) {
-        return reply.code(400).send({ error: "invalid redirect_uri", code: 400 });
+        throw BadRequestError("invalid redirect_uri");
     }
     const user = pg.pk?.["admin.users"]
         ? await pg
@@ -42,7 +39,7 @@ export default async function oauthToken(req, reply) {
             .then((el) => el.rows[0])
         : null;
     if (!user) {
-        return reply.code(404).send({ error: "user not found", code: 404 });
+        throw NotFoundError("user not found");
     }
     const expire = Math.min(jwtPayload.expires - jwtPayload.created || expireMsec, expireMsec);
     const href1 = await authorizeUser(user, req, "jwt", expire);
@@ -53,7 +50,7 @@ export default async function oauthToken(req, reply) {
     if (req.method === "POST" ||
         payload.noredirect ||
         process.env.NODE_ENV === "test") {
-        return reply.code(200).send("auth success");
+        return reply.status(200).send("auth success");
     }
     return reply.redirect(href);
 }

package/dist/server/routes/auth/controllers/page/login2faTemplate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login2faTemplate.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/page/login2faTemplate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAiC5D,wBAA8B,aAAa,CACzC,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,YAAY,kBA4EpB"}
+{"version":3,"file":"login2faTemplate.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/page/login2faTemplate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAkC5D,wBAA8B,aAAa,CACzC,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,YAAY,kBA4EpB"}

package/dist/server/routes/auth/controllers/page/login2faTemplate.js

@@ -7,6 +7,7 @@ import { handlebars } from "../../../../helpers/index.js";
 import pgClients from "../../../../plugins/pg/pgClients.js";
 import getTemplate from "../../../../plugins/table/funcs/getTemplate.js";
 import { getSecret, generate } from "../2factor/providers/totp.js";
+import { NotFoundError, UnauthorizedError } from "../../../../../errors.js";
 // relative default template filepath
 const filename = fileURLToPath(import.meta.url);
 const dirname = path.dirname(filename);
@@ -21,7 +22,7 @@ export default async function loginTemplate(req, reply) {
     const { pg = pgClients.client } = req;
     const { uid } = req.user || {};
     if (!uid) {
-        return reply.status(401).send({ error: "unauthorized", code: 401 });
+        throw UnauthorizedError("unauthorized");
     }
     const userExists = pg?.pk?.["admin.users"]
         ? await pg
@@ -29,7 +30,7 @@ export default async function loginTemplate(req, reply) {
             .then((el) => el.rows?.[0]?.uid)
         : false;
     if (!userExists && config.pg) {
-        return reply.status(404).send({ error: "user not found in db", code: 400 });
+        throw NotFoundError("user not found");
     }
     const customBody = await getTemplate("page", "2factor");
     const body = customBody || (await readFile(twoFactorPagePath, "utf8"));

package/dist/server/routes/auth/index.d.ts

@@ -1,4 +1,3 @@
-import { FastifyInstance } from "fastify";
-declare function plugin(app: FastifyInstance, opt?: any): void;
+declare function plugin(app: any, opt?: any): void;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/server/routes/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/routes/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAkD1C,iBAAS,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,GAAE,GAAQ,QAwFlD;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/routes/auth/index.ts"],"names":[],"mappings":"AA+CA,iBAAS,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAE,GAAQ,QA4FtC;AAED,eAAe,MAAM,CAAC"}

package/dist/server/routes/auth/index.js

@@ -20,7 +20,8 @@ import login2faTemplate from "./controllers/page/login2faTemplate.js";
 import oauthAuthorize from "./controllers/jwt/authorize.js";
 import oauthToken from "./controllers/jwt/token.js";
 import qrCode from "./controllers/2factor/qrcode.js";
-const params = { config: { policy: "L0" } };
+const tags = ["core", "auth"];
+const params = { config: { policy: "L0", tags } };
 const registrationSchema = {
     body: {
         type: "object",
@@ -64,14 +65,14 @@ function plugin(app, opt = {}) {
         app.get("/2factor/recovery", params, recovery);
     }
     if (!app.hasRoute({ method: "GET", url: "/2factor/reset" })) {
-        app.get("/2factor/reset", { config: { role: "admin" } }, reset);
+        app.get("/2factor/reset", { config: { tags, role: "admin" } }, reset);
     }
     // get/edit user info
     if (!app.hasRoute({ method: "GET", url: "/user" })) {
         app.get("/user", params, getUserInfo);
     }
     if (!app.hasRoute({ method: "POST", url: "/user" })) {
-        app.post("/user", { config: { auth: "creds" } }, updateUserInfo);
+        app.post("/user", { config: { tags, auth: "creds" } }, updateUserInfo);
     }
     // jwt
     if (!app.hasRoute({ method: "GET", url: "/oauth/authorize" })) {

package/dist/server/routes/cron/controllers/cronApi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cronApi.d.ts","sourceRoot":"","sources":["../../../../../server/routes/cron/controllers/cronApi.ts"],"names":[],"mappings":"AAEA,wBAA8B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAsBzD"}
+{"version":3,"file":"cronApi.d.ts","sourceRoot":"","sources":["../../../../../server/routes/cron/controllers/cronApi.ts"],"names":[],"mappings":"AAGA,wBAA8B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAoBzD"}

package/dist/server/routes/cron/controllers/cronApi.js

@@ -1,17 +1,16 @@
+import { ForbiddenError, NotFoundError } from "../../../../errors.js";
 import cronList from "../../../plugins/cron/cronList.js";
 export default async function cronApi(req, reply) {
     const { params = {}, user = {}, hostname } = req;
     if ((!user.uid || !user.user_type?.includes("admin")) &&
         !hostname?.includes("local")) {
-        return reply.status(403).send({ error: "access restricted", code: 403 });
+        throw ForbiddenError("access restricted");
     }
     if (params.name === "list") {
         return { data: Object.keys(cronList || {}) };
     }
     if (!cronList[params.name]) {
-        return reply
-            .status(404)
-            .send({ error: `cron not found: ${params.name}`, code: 404 });
+        throw NotFoundError(`cron not found: ${params.name}`);
     }
     const result = await cronList[params.name]?.(req, reply);
     return result;

package/dist/server/routes/cron/index.js

@@ -8,6 +8,6 @@ const cronSchema = {
     },
 };
 function plugin(app, opt = {}) {
-    app.get("/cron/:name", { config: { role: "admin" }, schema: cronSchema }, cronApi);
+    app.get("/cron/:name", { config: { role: "admin", tags: ["core", "cron"] }, schema: cronSchema }, cronApi);
 }
 export default plugin;

package/dist/server/routes/crud/controllers/deleteCrud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deleteCrud.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/deleteCrud.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAc5C,wBAA8B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBAmJrE"}
+{"version":3,"file":"deleteCrud.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/deleteCrud.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAe5C,wBAA8B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBA6HrE"}

package/dist/server/routes/crud/controllers/deleteCrud.js

@@ -7,6 +7,7 @@ import getOpt from "../../../plugins/crud/funcs/getOpt.js";
 import getTemplate from "../../../plugins/table/funcs/getTemplate.js";
 import { resources } from "../../../plugins/access/funcs/getResources.js";
 import dataDelete from "../../../plugins/crud/funcs/dataDelete.js";
+import { BadRequestError, ForbiddenError } from "../../../../errors.js";
 export default async function deleteCrud(req, reply) {
     const { pg = pgClients.client, user = {}, params = {}, headers = {}, method, } = req || {};
     const hookData = (await applyHook("preDelete", {
@@ -15,8 +16,9 @@ export default async function deleteCrud(req, reply) {
         id: params?.id,
         user,
     }));
+    // hooks should throw custom errors instead, this is temp solution to avoid breaking changes in hooks
     if (hookData?.message && hookData?.status) {
-        return reply.status(hookData.status).send(hookData.message);
+        throw new Error(hookData.message);
     }
     const { referer } = headers;
     const tokenData = (await getToken({
@@ -36,50 +38,32 @@ export default async function deleteCrud(req, reply) {
             ? req.params
             : {});
     if (actionsToken && !actionsToken?.includes("del")) {
-        return reply.status(403).send({
-            error: "del is not allowed ",
-            code: 403,
-        });
+        throw ForbiddenError("del is not allowed ");
     }
     const { actions = [], message: accessMessage } = (await getAccess({ resource, table: del, id, user, method }, pg)) || {};
     if (accessMessage) {
-        return reply.status(403).send({
-            error: accessMessage,
-            code: 403,
-        });
+        throw ForbiddenError(accessMessage);
     }
     if (!resource &&
         !tokenData &&
         !config?.local &&
         !config.security?.disableToken &&
         !config.auth?.disable) {
-        return reply.status(403).send({
-            error: "invalid token",
-            code: 403,
-        });
+        throw ForbiddenError("invalid token");
     }
     if (!actions.includes("del") &&
         !config.security?.disableToken &&
         !config?.local &&
         !tokenData) {
-        return reply.status(403).send({
-            error: "access restricted: actions",
-            code: 403,
-        });
+        throw ForbiddenError("access restricted: actions");
     }
     const loadTemplate = await getTemplate("table", del);
     const { table } = loadTemplate || hookData || tokenData || req.params || {};
     if (!table) {
-        return reply.status(404).send({
-            error: "table is required",
-            code: 404,
-        });
+        throw BadRequestError("table is required");
     }
     if (!id) {
-        return reply.status(404).send({
-            error: "id is required",
-            code: 404,
-        });
+        throw BadRequestError("id is required");
     }
     const data = await dataDelete({
         pg,
@@ -93,17 +77,11 @@ export default async function deleteCrud(req, reply) {
         if (err.message?.includes?.("foreign key") ||
             err.message?.includes?.("unique")) {
             const constraint = err.message.match(/constraint "([^"]+)"/g);
-            return reply.status(400).send({
-                error: `Видалення заборонено для збереження цілісності БД: ${constraint}`,
-                code: 400,
-            });
+            throw BadRequestError(`Видалення заборонено для збереження цілісності БД: ${constraint}`);
         }
         if (config.trace)
             console.error(err.toString());
-        return {
-            error: err.toString(),
-            code: 400,
-        };
+        throw BadRequestError(err.toString());
     });
     return reply.status(200).send({
         rowCount: data?.rowCount || 0,

package/dist/server/routes/crud/controllers/insert.d.ts

@@ -1,3 +1,3 @@
 import { type FastifyReply } from "fastify";
-export default function insert(req: any, reply: FastifyReply): Promise<never>;
+export default function insert(req: any, reply: FastifyReply): Promise<any>;
 //# sourceMappingURL=insert.d.ts.map

package/dist/server/routes/crud/controllers/insert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/insert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAgB5C,wBAA8B,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBA2NjE"}
+{"version":3,"file":"insert.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/insert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAsB5C,wBAA8B,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,gBA8MjE"}

package/dist/server/routes/crud/controllers/insert.js

@@ -10,10 +10,11 @@ import getAccess from "../../../plugins/crud/funcs/getAccess.js";
 import getToken from "../../../plugins/crud/funcs/getToken.js";
 import getTemplate from "../../../plugins/table/funcs/getTemplate.js";
 import { resources } from "../../../plugins/access/funcs/getResources.js";
+import { BadRequestError, ConflictError, ForbiddenError, NotFoundError, } from "../../../../errors.js";
 export default async function insert(req, reply) {
     const { pg = pgClients.client, user = {}, params = {}, body = {}, headers = {}, method, } = req || {};
     if (!user) {
-        return reply.status(403).send({ error: "access restricted", code: 403 });
+        throw ForbiddenError("access restricted");
     }
     const hookData = (await applyHook("preInsert", {
         pg,
@@ -21,11 +22,12 @@ export default async function insert(req, reply) {
         user,
         body,
     }));
+    // hooks should throw custom errors instead, this is temp solution to avoid breaking changes in hooks
     if (hookData?.message && hookData?.status) {
-        const response = hookData.status >= 400
-            ? { error: hookData.message, code: hookData.status }
-            : hookData.message;
-        return reply.status(hookData.status).send(response);
+        if (hookData.status >= 400) {
+            throw new Error(hookData.message);
+        }
+        return hookData.message;
     }
     const { referer } = headers;
     const tokenData = await getToken({
@@ -45,33 +47,28 @@ export default async function insert(req, reply) {
             : {});
     const { actions = [], message: accessMessage } = (await getAccess({ resource, table: add, form, user, method }, pg)) || {};
     if (accessMessage) {
-        return reply.status(403).send({
-            error: accessMessage,
-            code: 403,
-        });
+        throw ForbiddenError(accessMessage);
     }
     if (!resource &&
         !tokenData &&
         !config.local &&
         !config.security?.disableToken &&
         !config.auth?.disable) {
-        return reply.status(400).send({ error: "invalid token", code: 400 });
+        throw BadRequestError("invalid token");
     }
     if (!actions.includes("add") &&
         !config.security?.disableToken &&
         !config.local &&
         !tokenData) {
-        return reply
-            .status(403)
-            .send({ error: "access restricted: actions", code: 403 });
+        throw ForbiddenError("access restricted: actions");
     }
     if (!add) {
-        return reply.status(400).send({ error: "table is required", code: 400 });
+        throw BadRequestError("table is required");
     }
     const loadTemplate = await getTemplate("table", add);
     const { table } = loadTemplate || hookData || tokenData || req.params || {};
     if (!table) {
-        return reply.status(404).send({ error: "table not found", code: 404 });
+        throw NotFoundError("table not found");
     }
     const formData = form || loadTemplate?.form
         ? (await getTemplate("form", form || loadTemplate?.form)) || {}
@@ -86,10 +83,7 @@ export default async function insert(req, reply) {
             uid: user?.uid,
             msg: xssCheck.error,
         });
-        return reply.status(409).send({
-            error: "Дані містять заборонені символи. Приберіть їх та спробуйте ще раз",
-            code: 409,
-        });
+        throw ConflictError("Дані містять заборонені символи. Приберіть їх та спробуйте ще раз");
     }
     const fieldCheck = validateData({ body, schema });
     if (fieldCheck.error) {
@@ -99,10 +93,7 @@ export default async function insert(req, reply) {
             uid: user?.uid,
             ...fieldCheck,
         });
-        return reply.status(409).send({
-            error: "Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз",
-            code: 409,
-        });
+        throw ConflictError("Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз");
     }
     const sqlCheck = checkSQL({ body, schema });
     if (sqlCheck.error) {
@@ -112,10 +103,7 @@ export default async function insert(req, reply) {
             uid: user?.uid,
             ...sqlCheck,
         });
-        return reply.status(409).send({
-            error: "Дані містять заборонені sql символи. Приберіть їх та спробуйте ще раз",
-            code: 409,
-        });
+        throw ConflictError("Дані містять заборонені sql символи. Приберіть їх та спробуйте ще раз");
     }
     if (![add, table].includes("admin.users")) {
         Object.assign(body, { uid: user?.uid, editor_id: user?.uid });
@@ -137,7 +125,7 @@ export default async function insert(req, reply) {
         referer,
     });
     if (!res) {
-        return reply.status(400).send({ error: "nothing added", code: 400 });
+        throw BadRequestError("nothing added");
     }
     const pk = pg.pk?.[loadTemplate?.table || table];
     const id = res[pk];
@@ -159,7 +147,5 @@ export default async function insert(req, reply) {
         payload: res,
         user,
     });
-    return reply
-        .status(200)
-        .send({ id, rows: res.rows, extra: res.extra, ...(res || {}) });
+    return { id, rows: res.rows, extra: res.extra, ...(res || {}) };
 }

package/dist/server/routes/crud/controllers/table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgB5C,wBAA8B,QAAQ,CACpC,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,GAAG,gBAoQZ"}
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAqB5C,wBAA8B,QAAQ,CACpC,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,GAAG,gBA+PZ"}

package/dist/server/routes/crud/controllers/table.js

@@ -8,6 +8,7 @@ import setToken from "../../../plugins/crud/funcs/setToken.js";
 import getTemplate from "../../../plugins/table/funcs/getTemplate.js";
 import extraDataGet from "../../../plugins/extra/extraDataGet.js";
 import { resources } from "../../../plugins/access/funcs/getResources.js";
+import { BadRequestError, ForbiddenError, NotFoundError, } from "../../../../errors.js";
 export default async function tableAPI(req, reply, called) {
     const { pg = pgClients.client, params, user = {}, query = {}, method } = req;
     const tokenData = await getToken({
@@ -22,8 +23,12 @@ export default async function tableAPI(req, reply, called) {
         ...(tokenData || {}),
         user,
     }));
+    // hooks should throw custom errors instead, this is temp solution to avoid breaking changes in hooks
     if (hookData?.message && hookData?.status) {
-        return reply.status(hookData?.status).send(hookData?.message);
+        if (hookData.status >= 400) {
+            throw new Error(hookData.message);
+        }
+        return hookData.message;
     }
     const resource = resources[hookData?.resource || tokenData?.resource || params.table]
         ? tokenData?.resource || params.table
@@ -36,17 +41,17 @@ export default async function tableAPI(req, reply, called) {
     if (!loadTable &&
         !pg.pk?.[tokenData?.table] &&
         !(pg.pk?.[templateName] && called)) {
-        return reply.status(404).send({ error: "not found", code: 404 });
+        throw NotFoundError("table not found");
     }
     const { table: table1 = params.table, form: form1, obj, } = hookData || loadTable || tokenData || {};
     const table = loadTable?.table || table1;
     const form = loadTable?.form || form1;
     const id = hookData?.id || tokenData?.id || params.id;
     if (tokenData && !id) {
-        return reply.status(403).send({ error: "invalid token", code: 403 });
+        throw ForbiddenError("invalid token");
     }
     if (!table && !id) {
-        return reply.status(400).send("not enough params");
+        throw BadRequestError("not enough params: table && id");
     }
     const { actions = [], query: accessQuery, message: accessMessage, } = (await getAccess({
         resource,
@@ -57,35 +62,28 @@ export default async function tableAPI(req, reply, called) {
         method,
     }, pg)) || {};
     if (accessMessage) {
-        return reply.status(403).send({
-            error: accessMessage,
-            code: 403,
-        });
+        throw ForbiddenError(accessMessage);
     }
     if (!resource &&
         !tokenData &&
         !config?.local &&
         !config.security?.disableToken &&
         !called) {
-        return reply.status(400).send("invalid token");
+        throw ForbiddenError("invalid token");
     }
     if (!actions.includes("edit") &&
         !config?.local &&
         !config.security?.disableToken &&
         !tokenData &&
         !called) {
-        return reply
-            .status(403)
-            .send({ error: "access restricted: actions", code: 403 });
+        throw ForbiddenError("access restricted: actions");
     }
     const { pk, columns: dbColumns = [] } = await getMeta({
         pg,
         table,
     });
     if (!pk) {
-        return reply
-            .status(404)
-            .send({ error: `table not found: ${table}`, code: 404 });
+        throw NotFoundError(`table not found: ${table}`);
     }
     // const cols = columns.map((el) => el.name || el).join(',');
     const formData = (await getTemplate("form", form)) || {};
@@ -141,9 +139,7 @@ export default async function tableAPI(req, reply, called) {
         .query(q.replace(/{{uid}}/, user?.uid), [id])
         .then((el) => el.rows[0]);
     if (!data) {
-        return reply
-            .status(404)
-            .send({ error: `object not found: ${id}`, code: 404 });
+        throw NotFoundError(`object not found: ${id}`);
     }
     Object.keys(schema)
         .filter((key) => schema[key]?.type === "DataTable")

package/dist/server/routes/crud/controllers/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/update.ts"],"names":[],"mappings":"AAgBA,wBAA8B,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAqNxD"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../../server/routes/crud/controllers/update.ts"],"names":[],"mappings":"AAsBA,wBAA8B,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBA0MxD"}

package/dist/server/routes/crud/controllers/update.js

@@ -11,12 +11,13 @@ import getToken from "../../../plugins/crud/funcs/getToken.js";
 import getTemplate from "../../../plugins/table/funcs/getTemplate.js";
 import { resources } from "../../../plugins/access/funcs/getResources.js";
 import insert from "./insert.js";
+import { BadRequestError, ConflictError, ForbiddenError, UnauthorizedError, } from "../../../../errors.js";
 export default async function update(req, reply) {
     const { pg = pgClients.client, user, params = {}, body = {}, headers = {}, method, } = req;
     const { referer } = headers;
     const unittest = process.env.NODE_ENV === "test" || process.env.VITEST;
     if (!user) {
-        return reply.status(403).send({ error: "access restricted", code: 403 });
+        throw UnauthorizedError("unauthorized");
     }
     const hookData = (await applyHook("preUpdate", {
         pg,
@@ -24,11 +25,12 @@ export default async function update(req, reply) {
         id: params?.id,
         user,
     }));
+    // hooks should throw custom errors instead, this is temp solution to avoid breaking changes in hooks
     if (hookData?.message && hookData?.status) {
-        const response = hookData.status >= 400
-            ? { error: hookData.message, code: hookData.status }
-            : hookData.message;
-        return reply.status(hookData.status).send(response);
+        if (hookData.status >= 400) {
+            throw new Error(hookData.message);
+        }
+        return hookData.message;
     }
     const tokenData = await getToken({
         uid: user.uid,
@@ -56,34 +58,29 @@ export default async function update(req, reply) {
         method,
     }, pg)) || {};
     if (accessMessage) {
-        return reply.status(403).send({
-            error: accessMessage,
-            code: 403,
-        });
+        throw ForbiddenError(accessMessage);
     }
     if (!resource &&
         !tokenData &&
         !config.local &&
         !config.security?.disableToken &&
         !config.auth?.disable) {
-        return reply.status(400).send({ error: "invalid token", code: 400 });
+        throw ForbiddenError("invalid token");
     }
     if (!actions.includes("edit") &&
         !config.local &&
         !config.security?.disableToken &&
         !tokenData) {
-        return reply
-            .status(403)
-            .send({ error: "access restricted: actions", code: 403 });
+        throw ForbiddenError("access restricted: actions");
     }
     if (!edit) {
-        return reply.status(400).send({ error: "table is required", code: 400 });
+        throw BadRequestError("table is required");
     }
     if (!id && tokenData?.table) {
         return insert(req, reply);
     }
     if (!id) {
-        return reply.status(400).send({ error: "id is required", code: 400 });
+        throw BadRequestError("id is required");
     }
     const loadTemplate = await getTemplate("table", edit);
     const { table } = loadTemplate || hookData || tokenData || params || {};
@@ -103,10 +100,7 @@ export default async function update(req, reply) {
     const xssCheck = checkXSS({ body, schema });
     if (xssCheck.error && formData?.xssCheck !== false) {
         logger.file("injection/xss", { msg: xssCheck.error, table }, req);
-        return reply.status(409).send({
-            error: "Дані містять заборонені символи. Приберіть їх та спробуйте ще раз",
-            code: 409,
-        });
+        throw ConflictError("Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз");
     }
     const fieldCheck = validateData({ body, schema });
     if (fieldCheck.error) {
@@ -116,10 +110,7 @@ export default async function update(req, reply) {
             uid: user?.uid,
             ...fieldCheck,
         });
-        return reply.status(409).send({
-            error: "Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз",
-            code: 409,
-        });
+        throw ConflictError("Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз");
     }
     const sqlCheck = checkSQL({ body, schema });
     if (sqlCheck.error) {
@@ -129,10 +120,7 @@ export default async function update(req, reply) {
             uid: user?.uid,
             ...sqlCheck,
         });
-        return reply.status(409).send({
-            error: "Дані містять заборонені sql символи. Приберіть їх та спробуйте ще раз",
-            code: 409,
-        });
+        throw ConflictError("Дані не пройшли валідацію. Приберіть некоректні дані та спробуйте ще раз");
     }
     if (tokenData?.obj) {
         const objData = tokenData.obj?.split("#").reduce((p, el) => ({
@@ -158,5 +146,5 @@ export default async function update(req, reply) {
         payload: res,
         user,
     });
-    return reply.status(200).send(res);
+    return res;
 }

package/dist/server/routes/crud/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/routes/crud/index.ts"],"names":[],"mappings":"AAiBA,iBAAS,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAE,GAAQ,QAwBtC;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/routes/crud/index.ts"],"names":[],"mappings":"AAkBA,iBAAS,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAE,GAAQ,QAiCtC;AAED,eAAe,MAAM,CAAC"}